TeamSpirit: break-in to a development server leaks data on 28,824 records, including customer contacts and staff

According to TeamSpirit Inc., on 27 October a third party logged into a software development server without authorization and used credentials stored on it to take data from the cloud environment the company uses. It stopped the server and cut the outside connection path the same day, and is investigating with outside specialists and lawyers. It attributes the breach to flaws in the development server’s settings and information management, not to an unknown vulnerability. It reported to the privacy regulator on 30 October. [1]

The leak covers 28,824 deduplicated personal-data records, including 35 sensitive records. It includes names, emails and login IDs of contacts and users at current and past TeamSpirit customers, inquiry contents, attendance records of some customers’ employees, data of people who requested materials or made inquiries, and names, staff numbers, emails, joining and leaving dates and birthdays (month and day) of employees, including former ones. The fields vary by person, and no misuse has been confirmed. [1]